CVE-2018-18608

MEDIUM NUCLEI

Dedecms - XSS

Title source: rule

Description

DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php.

Nuclei Templates (1)

DedeCMS 5.7 SP2 - Cross-Site Scripting

MEDIUMVERIFIEDby ritikchaddha

Shodan: http.html:"DedeCms" || cpe:"cpe:2.3:a:dedecms:dedecms" || http.html:"dedecms"

FOFA: body="dedecms" || app="dedecms"

References (2)

[Exploit, Third Party Advisory] https://github.com/ky-j/dedecms/files/2504649/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.7.SP2.docx

[Exploit, Third Party Advisory] https://github.com/ky-j/dedecms/issues/8

Scores

CVSS v3 6.1

EPSS 0.0789

EPSS Percentile 92.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

dedecms/dedecms 5.7 sp2

Published Oct 23, 2018

Tracked Since Feb 18, 2026